Static IP for PayPay

# .env, ECS task definition, Kubernetes secret, wherever config lives
HTTPS_PROXY=https://user:pass@eu-01.outboundgateway.com:8443

# sign it the OPA way: nonce, epoch, body hash, then HMAC
NONCE=$(openssl rand -hex 4)
EPOCH=$(date +%s)
BODY='{"merchantPaymentId":"order_4821","amount":{"amount":1000,"currency":"JPY"},"codeType":"ORDER_QR"}'
CT='application/json'
HASH=$( { printf %s "$CT"; printf %s "$BODY"; } | openssl dgst -md5 -binary | base64)
MAC=$(printf '%s\n%s\n%s\n%s\n%s\n%s\n' /v2/codes POST "$NONCE" "$EPOCH" "$CT" "$HASH" \
  | openssl dgst -sha256 -hmac "$API_SECRET" -binary | base64)

# create a payment code, egressing from your static EU IP
curl -s -X POST https://apigw.paypay.ne.jp/v2/codes \
  -H "Authorization: hmac OPA-Auth:$API_KEY:$MAC:$NONCE:$EPOCH:$HASH" \
  -H "Content-Type: application/json" -d "$BODY"

import base64, hashlib, hmac, os, time, requests

def opa_headers(path, method, body, key, secret):
    nonce, epoch = os.urandom(4).hex(), str(int(time.time()))
    ct = "application/json"
    body_hash = base64.b64encode(hashlib.md5(ct.encode() + body).digest()).decode()
    payload = "\n".join([path, method, nonce, epoch, ct, body_hash])
    mac = base64.b64encode(hmac.new(secret.encode(), payload.encode(),
                                    hashlib.sha256).digest()).decode()
    return {"Content-Type": ct,
            "Authorization": f"hmac OPA-Auth:{key}:{mac}:{nonce}:{epoch}:{body_hash}"}

# create a payment code, egressing from your static EU IP
body = b'{"merchantPaymentId":"order_4821","amount":{"amount":1000,"currency":"JPY"},"codeType":"ORDER_QR"}'
requests.post("https://apigw.paypay.ne.jp/v2/codes",
              data=body,
              headers=opa_headers("/v2/codes", "POST", body,
                                  os.environ["PAYPAY_API_KEY"],
                                  os.environ["PAYPAY_API_SECRET"]))

import { ProxyAgent } from 'undici';
import crypto from 'node:crypto';

const dispatcher = new ProxyAgent(process.env.HTTPS_PROXY);

const nonce = crypto.randomBytes(4).toString('hex');  // 8 chars
const epoch = Math.floor(Date.now() / 1000);            // seconds
const body = JSON.stringify({
  merchantPaymentId: 'order_4821',
  amount: { amount: 1000, currency: 'JPY' },
  codeType: 'ORDER_QR',
});
const contentType = 'application/json';
const bodyHash = crypto.createHash('md5')
  .update(contentType).update(body).digest('base64');
const payload = ['/v2/codes', 'POST', nonce, epoch, contentType, bodyHash].join('\n');
const mac = crypto.createHmac('sha256', process.env.PAYPAY_API_SECRET)
  .update(payload).digest('base64');

const res = await fetch('https://apigw.paypay.ne.jp/v2/codes', {
  method: 'POST',
  dispatcher,
  headers: {
    'Content-Type': contentType,
    'Authorization': `hmac OPA-Auth:${process.env.PAYPAY_API_KEY}:${mac}:${nonce}:${epoch}:${bodyHash}`,
  },
  body,
});

# whitelist registration request to PayPay support:
#   your API key and merchant ID, plus both fixed IPv4 addresses
# PayPay notes configuration can take up to 4 days after the request

# route sandbox traffic through the same pair before the cutover,
# so going live changes credentials but never the source IP
HTTPS_PROXY=https://user:pass@eu-01.outboundgateway.com:8443

# debugging a live error? quote the X-REQUEST-ID response header
# to support; it identifies the exact call in PayPay's systems